https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 10:37:52 +0000 https://vulnerability.circl.lu/vuln/cve-2026-57175 <p><strong>Affected:</strong> python-social-auth social-core</p> <p>Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker&#39;s SAML identity to a logged-in victim&#39;s local account. The attacker could then authenticate through SAML and gain access to the victim&#39;s account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.</p> <p><strong>Affected:</strong> python-social-auth social-core</p> <p>Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker&#39;s SAML identity to a logged-in victim&#39;s local account. The attacker could then authenticate through SAML and gain access to the victim&#39;s account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs.</p> https://vulnerability.circl.lu/vuln/cve-2026-57175